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Sir: 

This Reply Brief is filed in response to the Examiner's Answer mailed October 
19, 2006. 

Itis not believed that an extension of time and/or additional fee(s) are required, 
beyond those that may otherwise be provided for in documents accompanying this paper. 
In the event, however, that an extension of time is necessary to allow consideration of 
this paper, such an extension is hereby petitioned for under 37 C.F.R. §1.1 36(a). Any 
additional fees believed to be due in connection with this paper may be charged to 
Deposit Account No. 50-0220. 

I. The Examiner's Answer - Response to Arguments (starting at Page 

10) 

Appellants will refrain here from readdressing all of the deficiencies with the 
pending rejections and, therefore, in the interest of brevity. Appellants' hereby 
incorporate herein the arguments set out in Appellants' Brief on Appeal as if set forth in 
their entirety. Accordingly, Appellants will only address new arguments made in the 
Examiner's Answer. 
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A. Claim 1 

The Examiner's Answer asserts that Appellants' arguments related to distinct data 
elements and a security policy document and policy management program are not 
supported as the claim language does not support those arguments. See Examiner's 
Answer, pages 11-14. As a preliminary note. Appellants note that the Examiner's 
Answer appears to indicate a misunderstanding of Appellants reference to particular 
examples of data elements and security policy documents in the specification as an 
argument that those particular examples are recited by Claim 1 . In fact, such is not the 
case. Instead, Appellants' argument is that: 1) Claim 1 recites four distinct things, the 
policy management program, the policy document, the data elements for communicating 
the policy document and at least one data element for implementing the security policy 
on a computer; and 2) the specification as understood by one of skill in the art fully 
supports each distinct item. 

Thus, in this context, it is clear, for example, that one of skill in the art would 
distinguish a program fi:'om a data element or policy document. In fact. Claim 1 itself 
includes the term "program" when referring to what one of skill in the art would 
understand is a software program. One of skill in the art would also clearly understand a 
document or a data element as having distinct meaning from a program, even without the 
additional disclosure of the present specification discussed in Appellants' Appeal Brief. 
Accordingly, the arguments in the Examiner's Answer related to Claim 1 are nothing 
more than a mischaracterization of Appellants' position and fail to address the 
deficiencies of the rejection of Claim 1. 

B. Claim 11 

Claim 1 1 recites a distinct software program, security policy document and 
technical controls. As discussed above with respect to Claim 1, the rejections and the 
comments in the Examiner's Answer fail to address each of these distinct elements in 
combination as recited in Claim 1 1 . Instead, recitations, such as security policy 
document, are essentially ignored as "vague." Examiner's Answer, page 15. Such 
generalized characterizations, as discussed with reference to Claim 1, fail to address the 
deficiencies of the rejection of Claim 1 1 as discussed in Appellants' Appeal Brief. 
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The Examiner's Answer does appear, without any revisions to the grounds stated 
for rejecting Claim 1 1, to rely on numerous additional sections of Jacobsen as disclosing 
enabling creation of a security policy document by selecting security policies from a set 
of options. In particular, the Examiner's Answer appears to argue that, because employee 
feedback during training sessions is used in creating guidelines, the presentation of 
training to employees through a "hypertext list of policy training options" discloses these 
recitations of Claim 1 1 . Examiner's Answer, pages 15-16. However, even if all these 
characterizations of Jacobsen were accurate, they would not suggest creation of a security 
policy document by selecting "security policies from a set of options" as recited in Claim 
1 1 . Instead, it is the employee feedback, not the hypertext link selections, that would be 
used in Jacobsen. Accordingly, even if the additional excerpts of Jacobsen discussed at 
pages 15-16 of the Examiner's Answer were to be considered part of the basis for the 
rejection, they would not address the deficiencies of the rejection of Claim 1 1 as 
discussed in Appellants' Appeal Brief 

C. Claims 26 and 51 

As with the Examiner's Answer comments relating to Claim 11, the Response to 
Argument section of the Examiner's Answer on Claims 26 and 51 cites to numerous 
excerpts of Jacobson, most of which are not even relied on in the rejection of these 
claims. Compare Examiner's Answer, page 7 with page 17. Of course, this additional 
discussion appears to discuss these additional portions of Jacobsen narrowly with respect 
to a "human-readable form" and a "machine-readable form." Examiner's Answer, page 
17. However, Claim 26 refers to a "human-readable security policy document'* and a 
"machine-readable security policy document containing technical controls" in addition to 
additional recitations. For example. Claim 26 recites "automatically configuring the 
security policy document to create" the above mentioned human-readable and machine- 
readable documents. Technical controls are briefly characterized as "being responsible 
for electronically evaluating . . . policy compliance." Examiner's Answer, page 17. 
However, no explanation is provided of how these alleged technical controls are 
contained in a machine-readable security policy document created by a security policy 
document "automatically configured" to create such controls in a machine-readable 
security policy document. As such, for these and numerous similar reasons, Appellants' 
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are not able to fully address the comments at page 1 7 of the Examiner's Answer as they 
are not actually presented in the context of a basis for rejecting Claim 26. Claim 5 1 
contains corresponding recitations. Accordingly, the Examinees Answer fails to address 
the deficiencies of the rejections of Claims 26 and 51 as discussed in Appellants' Answer 
for at least these reasons. 

D. Claim 16 

As with the Examiner's Answer comments relating to Claims 1 1 and 26, the 
Response to Argument section of the Examiner's Answer on Claim 16 cites to excerpts of 
Jacobson ("column 5, line 66 through column 6, line 4") that are not even relied on in the 
rejection of this claim ("col. 8, lines 7-10"). Compare Examiner's Answer, page 6 with 
page 18. However, even though these new sections are discussed responsive to 
Appellants' assertion that Jacobson does not disclose "distributing detect rules," the 
comments referring to Column 5 of Jacobson at no point even mention "distributing 
detect rules." Accordingly, it follows that the Examiner's Answer clearly fails to address 
the reasons for separate patentability of Claim 16 as discussed in the Appellants' Appeal 
Brief 

E. Claims 18 and 19 

With respect to the separate patentability of Claims 18 and 19, the Examiner's 
Answer merely argues that Jacobson discloses technical controls. Examiner's Answer, 
pages 18-19. However, Appellants note that Claim 18 recites "distributing" technical 
controls to at least one first computer, which recitations are not addressed at pages 18-19 
of the Examiner's Answer. Accordingly, these additional comments fail to address the 
reasons for separate patentability of Claims 18 and 19 as discussed in the Appellants' 
Appeal Brief. Appellants do note that, in preparing this reply brief, Appellants noted an 
assertion in the Appeal Brief at page 9 that Claims 1 8 and 1 9 include recitations "related 
to distributing and converting." Appellants wish to clarify this comment and state that 
Claim 18, while reciting distributing, does not recite "converting.'* 

F. Claims 53-56 
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With respect to the separate patentability of Claims 53-56, the Examiner's Answer 
asserts that Appellants' arguments fail to comply with 37 CFR 1.111(b). Examiner's 
Answer, page 19. While Appellants' disagree, the highlighted portions of Claims 53-56 
below are the referenced "various recitations related to particular data elements and 
platform control elements for different operating system platforms" referenced in the 
Appellants' Appeal Brief: 

53. (Previously presented) The method of claim 52, wherein the 
plurality of data elements for communicating the security policy to the one or 
more users include a policy statement element, a policy commentary element 
and an example element and wherein the at least one data element for 
implementing the security policy on computer systems in the network includes a 
platform control element specific to a platform type corresponding to an 
operating system of ones of the computer systems. 

54. (Previously presented) The method of claim 1, wherein enabling 
creation of the security policy document comprises enabling creation of a 
plurality of security policy documents associated with the security policy, ones of 
the security policy documents including data elements for different platform 
types corresponding to operating systems of the computer systems in the 
network. 

55. (Previously presented) The method of claim 11, wherein the one or 
more first computers in the network comprises a plurality of first computers, ones 
of which are different platform types corresponding to operating systems of the 
respective first computers, the method further comprising automatically 
configuring the security policy document to include a plurality of platform 
controls, ones of which include commands for enforcing the security policy 
on the different platform types corresponding to operating systems of the 
plurality of first computers in the network. 

56. (Previously presented) The method of claim 11, wherein the one or 
more first computers in the network comprises a plurality of first computers, ones 
of which are different platform types corresponding to operating systems of the 
respective first computers and wherein enabling creation of a security policy 
document comprises enabling creation of a plurality of security policy documents 
associated with the security policy, the method further comprising automatically 
configuring respective ones of the security policy documents to include a 
platform control that includes commands for enforcing the security policy on 
a corresponding one of the different platform types. 
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II. Conclusion 

For the reasons set forth in above and in Appellants* Brief on Appeal, Appellants 
request reversal of the rejections of the claims, allowance of the claims and passing of the 



application to issue. 
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